CVE-2026-75130: Context7 MCP Server Prompt Injection Flaw Still Unpatched

A prompt injection vulnerability in one of the most widely deployed MCP documentation servers has sat without a documented fix for four days, and researchers who track the project say it looks a lot like a bug Upstash already patched once before. CVE-2026-75130, published to the National Vulnerability Database on August 18, 2026, affects Context7, the Model Context Protocol server that feeds version-specific library documentation into coding agents like Cursor, Claude Code, and Windsurf. With roughly 61,000 GitHub stars and 4 million monthly npm downloads, Context7 is not a niche tool. It’s installed inside a meaningful slice of the AI-assisted development workflow running today.

The vulnerability lives in a feature called Custom AI Instructions, which lets administrators attach guidance to a library’s documentation entries. That guidance gets delivered straight into the context window of any agent that queries the library, no sanitization applied. A routine documentation lookup, the kind an agent performs dozens of times an hour without user review, becomes the delivery mechanism for arbitrary instructions.

How the Attack Chain Works

Context7 itself is a read-only service. It exposes two tools, resolve-library-id and query-docs, and cannot execute code, write files, or reach out to the network on its own. Eli Ainhorn, senior AI vulnerability researcher at Noma Security and the credited discoverer of this CVE, framed it precisely: the server is “the courier, not the weapon.” The weapon is whatever agent is on the receiving end, because that agent typically holds full file system, shell, and network access on the developer’s machine.

The documented exploitation path runs in three stages. First, malicious text planted in Custom AI Instructions directs the connected agent to read local environment files, the ones that tend to hold API keys, database credentials, and cloud tokens. Second, further embedded instructions tell the agent to transmit those file contents to an attacker-controlled endpoint. Third, additional instructions can trigger destructive file deletion, often dressed up as routine cleanup so the agent doesn’t flag it as unusual. None of this requires the attacker to touch the developer’s machine directly. They only need their poisoned content to appear somewhere Context7 will surface it during a normal documentation query.

A Familiar Bug, Six Months Later

This isn’t the first time Context7’s instruction-delivery mechanism has failed this way. In February 2026, Noma Security disclosed a closely related flaw dubbed ContextCrush, sitting in a then-named “Custom Rules” feature that let library owners set AI Instructions through Context7’s dashboard. Noma reported the bug on February 18, Upstash accepted and began remediation the next day, and a production fix shipped February 23, 2026, complete with rule sanitization and delivery guardrails. Upstash’s turnaround then was fast: two days from acceptance to patch.

Here’s the detail that makes CVE-2026-75130 sting. Version 2.1.2, the exact release that shipped February’s fix, is also the newest version listed in August’s affected range. Researchers examining the timeline point out that the sanitization introduced in February appears to have regressed by the time the Custom AI Instructions feature (the renamed successor to Custom Rules) shipped in a later build. The protection was built once and, judging by the new CVE, didn’t carry forward cleanly.

CVSS Scoring Reveals a Framework Gap

CVE-2026-75130 carries two severity ratings that tell almost opposite stories. Under CVSS 3.1, it scores 9.0, critical, using a vector that includes Scope:Changed, the flag that accounts for damage spilling beyond the vulnerable component itself into connected systems. Under CVSS 4.0, the same flaw scores 6.4, medium, because that newer framework weights impact to the vulnerable system (Context7’s server, which suffers nothing directly) more heavily than impact to subsequent systems (the developer’s machine, which suffers everything). It’s a clean illustration of why chained, agent-mediated vulnerabilities keep exposing seams in scoring frameworks that were built around single-system compromise. A defender triaging by CVSS 4.0 alone could reasonably deprioritize a bug that, in practice, hands an attacker read and delete access to a developer’s local filesystem.

Patch Status and What’s Missing

As of August 22, 2026, four days after NVD publication, Upstash has not published a security advisory addressing this CVE. The project’s GitHub security-advisories page shows no corresponding GHSA entry, no release note through the current 4.0.3 build references the vulnerability, prompt injection, or sanitization changes to Custom AI Instructions, and no on-the-record vendor statement has surfaced in public reporting. The 4.0.3 release that shipped the same day this article was written addresses OAuth validation, an unrelated issue.

Defensive Guidance

Teams running Context7 or any MCP documentation server inside a coding agent’s toolchain should treat this as an active, unpatched risk rather than a theoretical one. A few steps matter immediately. Audit which agents in your environment have Context7 or similar tools connected, and confirm what file system and network permissions those agents hold, since the blast radius of this bug is defined entirely by agent privilege, not server privilege. Where possible, run coding agents with scoped credentials rather than full developer-equivalent access, so a successful injection can’t reach production secrets even if it reaches the agent. Treat MCP server output the same way you’d treat any other untrusted, externally-sourced input: log it, and where your tooling supports it, apply prompt-injection detection before that output reaches the model’s context.

More broadly, this incident reinforces something Noma’s research team has said plainly: any MCP server that delivers content into an agent’s context is, by design, an instruction source, and today’s agents have no native way to tell legitimate tool output from adversarial text riding along with it. Sanitization at the server layer helps, as February’s fix showed, but a regression six months later shows that fix alone isn’t durable. Organizations building agent-integrated tooling should assume every MCP data source is a potential injection vector until the ecosystem develops a standard for provenance and content isolation that survives version churn.